Analysis
-
max time kernel
141s -
max time network
131s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
07-10-2024 06:31
General
-
Target
1bffaf984e5c68613b2da3fdfa1244ce_JaffaCakes118.apk
-
Size
1.5MB
-
MD5
1bffaf984e5c68613b2da3fdfa1244ce
-
SHA1
5e4abe059e7b55c4a77e2ea0d79aecaa4e4aed1b
-
SHA256
e981e67f3931a9c945e02f233ddfa7e3531ed7c58e670465ef390809c46b81da
-
SHA512
fafba366394e809e5453098fb34998ac351d4893870889b0a39fed3d5c96e268d301f7a4501f04ed063a955075fdf253188958896599a42c3035dd0c4c53b464
-
SSDEEP
24576:HDzrdq4KdLZMa4XnvMNoilSrzGiPy48em6+cWz13bh6:zdq40tVMMNoicHGiZPdWh3c
Malware Config
Extracted
alienbot
http://optimpres.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
ogumydadjhgfl.nxfwaskmujfjbj.wxrzgguabtsdtqyx1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries account information for other applications stored on the device
- Performs UI accessibility actions on behalf of the user
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
650KB
MD5b3f4caec5c7ac55185a0971a0db3b792
SHA141a4dee66538a33ab77e2ee893cdc209ff92a320
SHA256a74eceff67adeeb4b6dd2c27bb10a2f4ea3ae9021045b40c8342278739442077
SHA512598a8b0dfc64b44618fc92bd570b759ff8e32097055f291fb0c81c8d2e7a12aa01e56a58237b8c37124a2f26811c8fbe4b4a266242850b9800e014f453cfeac5
-
Filesize
650KB
MD53c0ffc5409b96991c5f8fbea443f1876
SHA13727e166c901d698555e8756c6a7e3979fe51b6f
SHA25656819060973fe8300696b58d33511a02c163eac7bf6a531ea4a1bb268fd6f5bd
SHA512d83495b137f4880ce38f0f2e843d441ed4d89af88b7c4c6ca092aea10c72047e4628ed39be1532c16682b92428fd66580388605d7ebf7cc18672076fdbb3e497
-
Filesize
406B
MD5632671c27171cd32975658921c4b73e5
SHA150b2555d0969b20e40eaba664bf1f881aae8042c
SHA256985601ebd2a02999ccd82f02f71c8273338914e1f936223f51068a67d829db3e
SHA512bdac14ce65494a6e54f185dc285e6735d28ff4d9cbf064e42741642ad474d7c59d1632dfb699b8b8c32bdd6dc3505547e6907f505307c2ac3e5cfc77212f77f4